We are currently using SP2010 with ADFS to implement the following scenario:

[Internet]->ADFS with Webform->[SP2010]<-ADFS with Windows Auth<-[Internal Network] SharePoint has only one Url (https://sp2010.publicdomain.com) for both, Internet and Intranet access.

For the migration to SP2013 we would like to get rid off ADFS and use Windows Auth (Kerberos) instead. The issue now: For internet access, there will be no form, but just the default browser credential dialog. However, for internal access this is correct (auto logon within intranet zone, so no login prompt for internal users)

We looked into using a reverse proxy to have a forms based logon for external access, but UAG/TMG is no longer sold and IIS Application Request Routing (which is the new recommendation from Microsoft for reverse proxies) does not support this "forms" scenario.

Important: We cannot extend the SharePoint WebApp and use two different Urls for intern/extern.

Any idea how to solve this? One more thing: We definitely don't want forms based auth only, because internal users must not see a logon prompt.

Thank you very much. If anything is not clear, please add a comment.

  • I am facing exactly the same challenge now, and would like to know if someone has some insight of this. Thank you. Commented Mar 17, 2014 at 20:43

1 Answer 1


Old Question - but I'll put the answer here for reference

The Microsoft recommendation is to use the Web Application Proxy role (which still requires ADFS). Internal users will can by pointed to SharePoint directly and external users would come in thru the proxy (which will be configured for FBA).

Web Application Role is supported on Windows 2012 R2 and you would deploy ADFS 3.0 as well in this scenario. You will find plenty of guidance on configuring WAP and ADFS. It's the 2nd part that is important.

enable delegation for the Web Application Proxy computer, you want constrained delegation and the you will point to the SPN that is configured for SharePoint WebApplication(you will point to the service account you set the SPN on).

On ADFS you will create a non-claims aware relying party trust. Add the web app URL as the identifier

Add claim rule Permit all users

Configure WAP Publish a new application, use ADFS for pre-auth, and then select your non-claim aware application you published in ADFS. You will have to provide the information for your application (certificate, spn endpoint, etc) and then publish.

Now when you browse the WAP you should be able to logon to SharePoint.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.